ShadowFi security record
As of 3 Nov 2026, ShadowFi has 2 audit reports by 2 security firms on Trustblock; the latest is by Cyberscope, dated 20 May 2024. Those reports list 2 open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| ShadowGold | Security firm: Cyberscope | Date: | Scope: 1 address on Polygon (POS) | 2 open critical findings | Open · cyberscope.io |
| Shadowfi | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings41
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 2 | 0 | 0 |
| Low | 28 | 0 | 8 |
Low`airdrop()` Missing ValidationShadowfi · CertiK · 21 Oct 2022Fixed
The airdrop sets the users to true after the call, but it does not check if the user has already been sent an airdrop. This might cause errors in accidentally double sending tokens.
Open the reportLow`airdrop()` Will Eventually Hit Block LimitShadowfi · CertiK · 21 Oct 2022Fixed
The function `airdrops()` can send multiple users tokens. Because this is a for loop, each call uses more gas as it successfully transfers tokens. If the list is big enough in one call, it could potentially hit the block limit.
Open the reportLowBNB Locked In Contract Over TimeShadowfi · CertiK · 21 Oct 2022Fixed
A small amount of BNB will be left in contract after each call. Typically very small, but will be locked forever. This is not worth adding a check and correcting this because it will typically increase the gas costs more than what is "saved".
Open the reportLowFunction Initializing StateShadowfi · CertiK · 21 Oct 2022Fixed
State variables are inline initialized using either non-constant state variable or function calls that are not pure/constant. Since inline initialization occurs before constructor call, some non-constant state variables may not be initialized and non-constant functions may behave in an unexpected way. ```solidity=550 uint256 public _maxTxAmount = _maxSupply / 1000; // 0.1% ``` --- ```solidity=595 uint256 public swapThreshold = _totalSupply / 5000; // 0.02% ```
Open the reportLowMissing Emit EventsShadowfi · CertiK · 21 Oct 2022Fixed
It is recommended emitting events for the sensitive functions that are controlled by centralization roles or are important for users. The functions referenced above do not emit events. For example: - `setDistributionCriteria()` - `setTxLimit()`
Open the reportLowMissing Input ValidationShadowfi · CertiK · 21 Oct 2022Fixed
The address noted above should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=306 owner = adr; ``` - `adr` is not zero-checked before being used.
Open the reportLowUnknown BoundsShadowfi · CertiK · 21 Oct 2022Fixed
The variables inside of `setDistributionCriteria()` have no boundaries and can be set arbitrarily. These variables dictate the time and minimal amount of tokens for distribution inside of `DividendDistributor`. These variables should have a error boundary check.
Open the reportLowVariables Should Be Declared ConstantShadowfi · CertiK · 21 Oct 2022Fixed
The following state variables never change should be declared as `constant` to save gas. - `WBNB` - `dividendsPerShareAccuracyFactor` - `BUSD` - `DEAD` - `ZERO` - `_totalSupply` - `_maxSupply`
Open the reportContracts1
| Address | Chain | Source code |
|---|---|---|
| 0x8bc3ec2e7973e64be582a90b08cadd13457160fe | Chain: Polygon (POS) | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="shadowgold"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us